port-mass-scan

1# Port Mass Scan Skill
2 
3High-speed port scanning methodology using RustScan for single hosts and Masscan for large IP ranges. RustScan provides 400x speedup over Nmap for 1000-port scans (3-10s vs 5-10min). Masscan handles /8 and /16 ranges that Nmap cannot. The ISP and government network examples below were from authorized infrastructure assessments with signed RoE.
4 
5## When to Use
6 
7- Authorized red team engagement with signed RoE covering the target IP range.
8- Fast single-host port discovery before Nmap service enumeration.
9- After `subdomain-enumeration` — scan resolved IPs for non-HTTP services.
10- ISP-wide or /8 scanning without explicit written authorization is illegal in most jurisdictions. This skill exists for legitimate authorized engagements, not mass scanning.
11 
12## Prerequisites
13 
14- `terminal` with masscan, rustscan, and nmap installed.
15- For Masscan: root access (uses raw sockets), libpcap.
16- For RustScan: nmap must be installed (for service enumeration pass-through).
17 
18## How to Run
19 
20```bash
21# Single host — RustScan (3-10 seconds for 1000 ports)
22rustscan -a TARGET -r 1-65535 -- -sV
23 
24# /24 range — Masscan (2-5 minutes)
25masscan -p1-65535 --rate=10000 -iL targets.txt -oJ scan.json
26 
27# /8 range — Masscan with banner grab (hours)
28masscan -p80,443,8080,8443,22,3306,6379 --rate=50000 --banners -iL /8_range.txt -oJ scan.json
29```
30 
31## Quick Reference
32 
33| Scenario | Tool | Command | Time |
34|----------|------|---------|------|
35…